Is Us Auctions MCP server safe?
Yes, with the usual care.
Safe to use. Minor gaps such as a missing repository or slower maintenance.
What to know before installing
- highWrite-action tools reachable without authentication
How Us Auctions compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 80/100
- higher than 60% of 48,255 servers
- Tools that change things
- 6%
- typical: 0%. Fewer write tools means less an agent can break
- Uptime
- 100%
- of our recent checks; the typical remote server answers 100%
What its tools let an agent do: 44 read · 1 create · 2 change · 3 delete
Release history: 6 versions in the registry since 2026-08-27, latest 2026-10-29, typically one every 13 days.
Public scan report
scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it
1 high1 low
- Code scan5 source files scanned25/25
- Live reliabilityremote reachable in 3093ms17/20
- Tool poisoning50 tool descriptions checked13/15
- Auth qualityopen endpoint exposes 3 write-action tools with no auth3/15
- Maintenancelast push 1 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
Findings (2)
- highWrite-action tools reachable without authentication
auth.open-write - lowUnusually long tool description (over 2,000 characters)
poison.long-descriptiontool entity_profile: …"Tell me about X" / "research Acme" / "brief me on Tesla" / "what does Apple do" / "company profile for Microsoft" / "give me the rundown on NVDA" / "everything you know about $TICKER" — full cross-source profile of a US public company in ONE parallel call. ALWAYS PREFER over chaining single-pack SEC/XBRL/news lookups when the user asks for a holistic view. Fans out across SEC EDGAR, XBRL, USPTO patents, federal contracts (USAspending), FDA-licensed biologics (Purple Book), H-1B hiring (DOL LCA), news and GLEIF, and returns: cik + company_name (+ resolved_from/resolved_to when `value` was a name); recent_filings (up to 5 with pipeworx://edgar/company/{cik}/filings/{accession} URIs); fundamentals (the latest ANNUAL Revenues, NetIncomeLoss, Cash, diluted EPS, capex and operating cash flow, each with its period_end, SEC form and the accession of the filing it came from — plus EntityCommonStockSharesOutstanding, which is the newest COVER-PAGE share count the filer has published rather than an annual one, so its period_end is a cover date after the quarter closed and it is the right per-share denominator; a filer tagging a fallback concept appears under the name of that tag instead, e.g. PaymentsToAcquireProductiveAssets instead of PaymentsToAcquirePropertyPlantAndEquipment); patents (USPTO PatentsView API sunset May 2025 — soft-fails until reactivated); federal_contracts (USAspending awards where the company is the recipient); fda_products (FDA-licensed biologics — vaccines, cell/gene therapies — from the Purple Book; a company with only small-molecule/generic drugs will show none here, that is expected, not a failure); hiring (H-1B sponsorship volume + salary range from DOL LCA filings); recent news mentions via GDELT→GNews fallback; LEI via GLEIF. `sources_used` / `sources_failed` say which of these actually returned data for THIS company — an empty section is a real "no data", not a bug. `sources_skipped` is the third state: a leg we deliberately did NOT run, each entry carrying a `reason` token and a plain-English `detail` (the Purple Book is skipped for a filer SEC classifies outside the life-science SIC bands, since it lists only 351(a)/(k) biologics licence holders). Pass a ticker ("AAPL"), zero-padded CIK ("0000320193"), OR a company name ("Moderna") — names now resolve via SEC EDGAR's company-name match; a private company (no CIK/ticker) returns resolved:false with an explicit `notes` line, not a bare failure. `type` accepts "company" or "ticker" interchangeably — both take the same `value` shapes above.…
Overall 80/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON